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BACKGROUND 

1 . Field of the Invention 

The present invention relates to telecommunications, and more particularly to a method 
and system for allowing multiple service providers to serve users via a common access network 
5 such as a wireless local access network for instance. 

2. Description of Related Art 

In recent years, wireless local area networking has become increasingly popular. 
Provided with a suitable wireless communication device, a user operating in a wireless local area 
network (WLAN) can conveniently gain access to network resources without being tethered to a 
10 fixed location. 

A WLAN can take various forms, one of the most common of which is that described by 
□ industry standard IEEE 802.1 1 (as modified by 802.1 lb). Applicable details of 802.1 1 are well 
O known to those of ordinary skill in the art and therefore will not be described. 
;f! Generally speaking, in an 802.11 WLAN, one or more access points (APs) are provided 

'*& as base stations to interface between mobile stations and a distribution system (e.g., a wired 
Ethernet or other system). When a mobile station first enters an 802.11 WLAN, the mobile 
station becomes associated with a nearby AP and becomes authenticated for purposes of 
Q communicating within the WLAN. Depending on the scope of authentication, the mobile station 
S may then be able to communicate with other mobile stations operating on the WLAN and/or with 
m various servers or other entities in the distribution system. Further, the distribution system may 
provide connectivity with another network such as the Internet for instance. Therefore, the 
mobile station might be able to access resources on that other network as well. 

SUMMARY 

25 The present invention is directed to a method and system for enabling multiple service 

providers to serve subscribers via a common wireless access network. The common wireless 
access network preferably includes or is a WLAN, such as an 802.1 1 WLAN for instance, but it 
could take other forms as well. 

In an exemplary embodiment of the invention, the access network is arranged to serve 

30 one or more mobile subscriber stations (such as 802. 11 -compliant stations), and the access 
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network provides connectivity to a plurality of service provider systems (e.g., discrete service 
provider networks, or separate service provider systems on a common network). Each service 
provider system may be owned and operated by a respective service provider. And each service 
provider may have its own set of subscribers, that is, client stations and/or users that are 
5 registered to access services of the service provider and/or to be billed by the service provider for 
accessing services. 

When a mobile station enters the access network, the access network may give the mobile 
station access only to certain resources on the access network or may have some other default 
access that is enforced by an access point, a switch and/or other nodes on the network. For 
10 example, an access network may by default allow the mobile station to engage in IP 
s , communications with other mobile stations in the access network or with web servers in the 
13 access network. As another example, if the access network provides connectivity with the 
O Internet, the access network may by default allow the mobile station to engage in IP 
J communications with entities on the Internet. 

*§5 According to the exemplary embodiment, upon gaining access to the access network (or 

at another time during operation in the access network), the mobile station then sends into the 
;Z access network an authentication request that indicates (i) a designated one of the service 
O providers and (ii) authentication credentials. The access network then forwards that 
q authentication request to the designated service provider, to facilitate authentication of the 
hft) mobile station. 

In turn, the designated service provider seeks to authenticate the mobile station and 
provides an authentication response to the access network. The authentication response may 
indicate that the mobile station is not authenticated (e.g., if the mobile station does not subscribe 
to the designated service provider's service). Alternatively, the authentication response may 

25 indicate that the mobile station is authenticated, and the authentication response may provide the 
access network with service qualifications for the mobile station (such as types or levels of 
communication that the mobile station is allowed to perform). 

Upon receipt of the authentication response, the access network then preferably controls 
communications accordingly. In particular, if the authentication response indicates that the 

30 designated service provider authenticated the mobile station, then the access network may allow 
the mobile station to communicate within a layer of access-network traffic (e.g., in a specific 
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sub-network for instance) that is segregated for the designated service provider. Within that 
segregated layer, the access network may then provide the mobile station with services that are 
specific to the service provider, such as customizing access-network resources to make them 
appear as though they are provided by the service provider. Further, upon successful 
5 authentication, the access network may enforce service qualifications specified by the designated 
service provider. 

Alternatively, if the authentication response indicates that the designated service provider 
did not authenticate the mobile station, then the access network may continue to restrict the 
mobile station to communicate only to the extent the access network allowed by default (or in 
1 0 another manner desired) . 

e , These as well as other aspects and advantages of the present invention will become 

S apparent to those of ordinary skill in the art by reading the following detailed description, with 
□ appropriate reference to the accompanying drawings. 

'§> 

J BRIEF DESCRIPTION OF THE DRAWINGS 

o An exemplary embodiment of the present invention is described herein with reference to the 

H drawings, in which: 

^to Figure 1 is a generalized block diagram of a communications system in which the 

exemplary embodiment can be employed; 

Figure 2 is a flow chart depicting functions that can be carried out according to the 
exemplary embodiment; 

Figure 3 is a more detailed block diagram of a communications system in which the 
25 exemplary embodiment can be employed; and 

Figure 4 is a block diagram of a data store suitable for use in the system shown in Figure 

3. 
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DETAILED DESCRIPTION OF 
AN EXEMPLARY EMBODIMENT 

1. Overview 

Referring to the drawings, Figure 1 is a generalized block diagram of a communications 
5 system 10 arranged in accordance with an exemplary embodiment of the invention, and Figure 2 
is a flow chart depicting functions that may be performed in the arrangement of Figure 1. As 
shown in Figure 1, system 10 includes an access network 12 (e.g., an 802.11 WLAN), which is 
arranged to serve exemplary subscriber stations 14a, 14b via one or more suitable access points 
16. The access network is shown to include a policy enforcement point 18 (possibly integrated 
10 with or embodied in the access point 16), which can operate to restrict or allow various types of 
communications in the access network. The access network is shown, in turn, coupled with 
Z multiple service provider systems 20, 22 and 24. Each service provider system is then shown to 
O include a respective authentication entity 26, 28, 30. 

,p Referring now to the flow chart of Figure 2, at block 32, the subscriber station 14 

establishes an association with the access network, such as via a radio-link layer coupling 
P between the subscriber station and the access point 16. At block 34, the subscriber station then 
sends an authentication request message into the access network, identifying both (i) a 
ji; designated one of the service provider systems (e.g., a service provider ID, for instance) and (ii) 
ijj one or more authentication credentials (such as subscriber ID (e.g., user ID or station ID) and 
rio password). For example, the authentication request message might identify service provider 
system 20 and might provide a username and password for a user of the subscriber station. 

At block 36, the access network then sends the authentication request message (possibly 
reformatted or changed in some respect) to the authentication entity of the service provider 
system designated by the request. Continuing with the example, at block 38, authentication 
25 entity 26 of service provider 20 would thus receive the request. At block 40, authentication 
entity 26 would then attempt to authenticate the subscriber station based on the authentication 
credentials carried in the request. For instance, the authentication entity 26 might refer to a 
subscriber profile store maintained by the service provider, to determine whether a subscriber 
record exists for the user and/or subscriber station. Further, upon finding a subscriber record in 
30 the profile store, the authentication entity might obtain a record of service qualifications 
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specified by the subscriber record, or might otherwise obtain or derive service qualifications for 
the subscriber. 

In turn, at block 42, the authentication entity will send an authentication response 
message to the access network. The authentication response will preferably include an indication 
5 (e.g., a Boolean indication) of whether the subscriber station is authenticated. Further, if the 
subscriber station is authenticated, the response will preferably include an indication of the 
subscriber station's service qualifications, such as types and extents of communication in which 
the service provider authorizes the subscriber station to engage. 

The policy enforcement point 18 on the access network then restricts or allows access 
10 network communications with (to and/or from) the subscriber station based on the authentication 
. ^ response. In particular, at block 44, the policy enforcement point determines whether or not the 
Q designated service provider has authenticated the subscriber station. In response to a 
O determination that the service provider did not authenticate the subscriber station, at block 46, 
'f: the policy enforcement point limits the subscriber station to access only default resources of the 
"MS access network. 

On the other hand, in response to a determination that the service provider authenticated 
iZ the subscriber station, at block 48, the policy enforcement point or other entity in the access 
O network may assign the subscriber station to a segregated communication layer, such as a 
n particular IP subnet, established for the designated service provider. In that segregated layer, the 
^0 policy enforcement point may be arranged to handle communications according to a set of 
handling logic specific to the service provider. And at block 50 the policy enforcement point 
then allows the subscriber station to communicate within that segregated communication layer. 
Further, at block 52, the policy enforcement point may restrict or allow communications 
pursuant to the service qualifications (if any) indicated in the authentication response. 
25 As a result, the subscriber station will be able to carry out services as authorized by the 

designated service provider (e.g., engaging in certain types or levels of communications). 
Further, as the subscriber station operates within a segregated communication layer associated 
with that service provider, the subscriber station (or a user of the subscriber station) may 
perceive the access network to be an operative extension of the service provider. For instance, 
30 the access network can provide the subscriber with services customized to reflect the service 
provider. 
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Advantageously, multiple subscribers operating in the access network may thus be served 
concurrently by multiple different service providers. And by the same token, multiple service 
providers can provide services to their respective subscribers concurrently via the common 
access network. 

5 For instance, one subscriber station 14a might access (and enjoy or be restricted by) the 

services of one service provider 20 via the access network 12, while another subscriber station 
14b accesses the services of another service provider 22 via the same access network 12. With 
the benefit of the exemplary arrangement, each subscriber station may benefit from and be billed 
by its respective designated service provider. 
10 2. Exemplary Architecture 

s 5 Turning now to Figure 3, a more detailed block diagram is presented to help further 

□ illustrate a possible arrangement and operation of the invention. It should be understood that this 
q and other arrangements described herein are provided for purposes of example only, and other 
% arrangements and other elements (e.g., machines, interfaces, functions, orders of elements, etc.) 
# can be used instead and some elements may be omitted altogether. Further, as in most 
communications applications, those skilled in the art will appreciate that many of the elements 
described herein are functional entities (each sometimes referred to as a particular "function") 
O that may be implemented as discrete components or in conjunction with other components, in 
q any suitable combination and location. 

^0 Figure 3 depicts a system that includes an access network 102 arranged to communicate 

with or interconnect client stations, of which exemplary stations 104, 106 are shown. Each client 
station may be operated by a respective user. As such, the station and/or the user may be 
referred to as a "subscriber/ 1 Further, a mobile station or user of a mobile station may be 
referred to as a mobile subscriber or a wireless subscriber. 

25 The access network may be a packet-switched network (e.g., an IP network), so that 

communications are carried as individually-routed packets through nodes of the network. 
Further, the access network can be assumed, by way of example, to be or include a WLAN such 
as an 802.11 WLAN. Therefore, the access network further includes one or more wireless access 
points (APs) (or access point functions), of which exemplary APs 108, 110 are shown. Two 

30 exemplary client stations (e.g., mobile stations) 104, 106 are shown, communicating with the 
APs via a wireless medium such as a radio frequency air interface for instance. 
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Exemplary access network 102 is shown to include or enable communication between a 
gateway function 112, a web server function 1 14, a DHCP server function 116, and an 
authentication relay function 118. The network may include other entities as well 

Gateway 110 provides connectivity between the access network and a public or private IP 
5 network 120 such as the Internet for instance. In the exemplary arrangement as shown, IP 
network 120, in turn, provides connectivity to a plurality of discrete service provider networks 
(service provider systems), of which exemplary networks A, B and C are shown, corresponding 
respectively with service providers A, B and C. Each service provider network might be a 
packet-switched network and might provide a respective firewall 122, 124, 126, for security. 
10 The various service providers may take any of a variety of forms, and each may or may 

y_ not normally be in the business of providing communication services to subscribers. For 
y example, service provider A might be a wireless communications carrier, which provides voice 

□ and data communication services to subscribers. 

T To provide data service to a mobile station 128, for instance, service provider A might 

,? §5 include a base transceiver station (BTS) 130, which communicates with the mobile station 128 
via an air interface 132. The BTS may then communicate with a base station controller (BSC) 
|rj 134, which communicates in turn with a packet data serving node (PDSN) 136. The PDSN 136 

□ then functions as a gateway to network A and in turn to DP network 120. In this arrangement, 
5 mobile station 128 may establish a point to point protocol (PPP) session with PDSN 136 and, 
-20 through PDSN 136, engage in packet communications with entities on IP network 120. 

To provide voice service to mobile station 128, service provider A might further include 
a mobile switching center (MSC) 138, which provides connectivity between the BSC 134 and 
the public switched telephone network (PSTN) 140. Alternatively or additionally, network A 
might include a trunk access gateway (TAG) 142, which provides connectivity between network 

25 A and the PSTN 140. Thus, mobile station 128 can engage in voice communications with 
entities on PSTN 130, along a path comprising BTS 130, BSC 134, and MSC 138. Or mobile 
station 128 may alternatively engage in voice communications over a path comprising BTS 130, 
BSC 134, PDSN 136 and TAG 142. Other arrangements are also possible. 

Service provider A might also include a service agent function 144 on network A. The 

30 service agent function 144 can function to assist in processing communications carried by 
service provider A. For instance, when a gateway such as PDSN 136 (and/or a SIP proxy, for 
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instance) detects a communication to or from a subscriber of service provider A, the gateway 
might signal up to service agent 144 for guidance. Service agent 144 might then reference a data 
store 146 that defines services and profile information and may thereby determine how the 
communication should be handled. The service agent may then signal back to the gateway or to 
5 another enforcement point, instructing how to handle the communication. 

As other examples, service providers B and C might be in businesses other than the 
communications business. For instance, service provider B might be a commercial airline. And, 
as yet another example, service provider C might be a national restaurant chain. Nevertheless, 
Figure 3 depicts networks B and C as having respective service agents 148, 150 and data stores 
10 152, 154, similar to network A. The reason for including these components in the exemplary 
I 5 embodiment will be described below. 

O In the exemplary embodiment, gateway 112 on network 102 may be an Ethernet switch 

q and/or a router, through which all packet communications on access network 102 pass on their 
% way to or from their destinations. A suitable gateway 112 could be embodied in a programmable 
;§5 "web switch" of the type available from Nortel Networks or Foundry Networks for instance. 
However, other implementations are possible as well. 

In accordance with the exemplary embodiment, gateway 112 will include packet control 
□ logic (software, firmware and/or hardware), so as to be able to inspect and manipulate packets 
q based on various criteria. For instance, the gateway may be programmed to allow or disallow 
^io transmission of packets based on information carried in packet headers (such as source address, 
destination address, type of communication, etc.) and/or to route or re-direct packets to 
predetermined destinations based on similar information. 

Through these or other techniques, the gateway will preferably be programmed (statically 
and/or dynamically) to segregate packet traffic into logical layers of the access network 102. 
25 One layer will be in place as a default access network layer, to serve subscribers who have 
established connectivity with the access network but have not been authenticated (or authorized) 
by a service provider such as provider A, B or C. In turn, other discrete layers may be provided 
to correspond with each of the service providers respectively. Thus, a separate layer may be 
provided for service provider A, another separate layer may be provided for service provider B, 
30 and another separate layer may be provided for service provider C. (Alternatively, there could 
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be some overlap; for instance, a separate layer could be provided for service provider A, while a 
common layer could be provided for service providers B and C.) 

Each logical layer of access network 102 can be defined in any of a variety of ways. For 
example, each layer can be set up as separate IP subnet on network 102, and subscribers to be 
5 served by the layer may be assigned IP addresses within that subnet. For example, IP subnet 
10.3.x.x could be defined as the default access network subnet for subscribers who have gained 
access to network 102 but have not been authenticated by an outside service provider ("default 
subnet"). IP subnet lOAx.x could be defined as a subnet for subscribers who have been 
authenticated by service provider A ("subnet A"), IP subnet 10.5.x.x could be assigned as a 
10 subnet for subscribers who have been authenticated by service provider B ("subnet B"), and IP 
subnet 10.6.x.x could be defined as a subnet for subscribers who have been authenticated by 
Q service provider C ("subnet C"). 

g Gateway 112 can then include logic that causes it to take special actions with respect to 

% packet traffic in these various subnets, depending on the subnet. These special actions can 
vl5 function to distinguish the layers and therefore to distinguish services based on the authenticating 
service provider (or lack thereof). The particular actions can take any of a variety of forms, the 
jr: some examples of which will now be described. 

O For instance, the gateway might be programmed with default logic indicating how to 

jSI handle packets traveling to and from an address in the default subnet. As an example, the default 
: : 10 logic might restrict unauthenticated subscribers to a limited set of resources, such as to access 
only web server 114 and/or to communicate only with others on the access network (but not 
outside of the access network). To do so, the default logic could include access control rules that 
prevent packets from traveling between an address on the default subnet and an address outside 
of the access network but allow packet traffic between nodes on the access network. Further, the 
25 default logic could cause the gateway to redirect to web server 114 any HTTP GET requests 
originating on the default subnet and destined for an IP address outside of the access network. 

As another example, the default logic might allow communications between the default 
subnet and addresses outside the access network, but the default logic might restrict those 
communications in some manner. For instance, the default logic might restrict the quality of 
30 service for such communications, by labeling outgoing packets with a relatively low quality of 
service tag or in some other manner. The default logic might also restrict the types of outgoing 
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communications that can be allowed, as reflected in the headers of outgoing packets from the 
default subnet. For example, the logic might bar outgoing FTP packets. As another example, the 
logic might bar outgoing SIP packets, so as to prevent a subscriber on the default subnet from 
initiating a session through use SIP signaling. Similar restrictions could be put in place for other 
5 packet types or protocols (such as HTTP, RTP, etc.) 

The gateway may in turn be programmed with a logic set A, indicating how to handle 
communications to and from addresses on subnet A. Logic set A might direct the gateway to 
allow all packet traffic between addresses on subnet A and addresses outside of the access 
network. As such, logic set A might allow subscribers on subnet A to send SIP and RTP packets 
10 into IP network 120, so as to be able set up and carry on real-time media communications. 
. . Provided that service provider A is appropriately equipped, service provider A might thereby 
□ carry Voice over IP (VoIP) communications between a subscriber on subnet A and TAG 128, so 
q as to allow the subscriber to engage in voice communications over PSTN 130. 
j! Logic set A might also allow greater freedom for communications between addresses on 

*§5 subnet A and addresses outside of the access network. For instance, logic set A might grant a 
\*~ relatively high level of service quality to packets traveling from an address on subnet A to an 
address on IP network 120. Logic set A might also allow other types of IP communications, 
O such as FTP traffic for instance. 

j» g Further, logic set A might cause the gateway to customize packet traffic in a manner that 

§■20 corresponds to service provider A. For example, logic set A might indicate that, when the 
gateway receives an HTTP response packet destined for an address on subnet A, the gateway 
should retrieve from storage and insert in the HTTP response packet a set of HTML code that 
defines a banner advertisement for service provider A. Thus, when a subscriber on subnet A 
receives a web page from a web server, the gateway may effectively inject into the web page a 

25 banner ad for service provider A. 

The gateway may then be programmed with a logic set B, indicating how to handle 
communications to and from addresses on subnet B. This logic might differ from logic set A and 
from the default logic. For example, logic set B might bar the communication of SIP packets 
from an address on subnet B to an address outside of the access network. But logic set B might 

30 allow FTP and RTP communications between addresses on subnet B and addresses on IP 
network 120. 
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As another example, logic set B might cause the gateway to customize packet traffic in a 
manner that corresponds to service provider B. For example, logic set B might indicate that, 
when the gateway receives an HTTP response packet destined for an address on subnet B, the 
gateway should retrieve from storage and insert in the HTTP response packet a set of HTML 
5 code that defines a banner ad for service provider B. Thus, when a subscriber on subnet B 
receives a web page from a web server, the gateway may effectively inject into the web page a 
banner ad for service provider B. 

In turn, the gateway may be programmed with a logic set C that indicates how to handle 
communications to or from addresses on subnet C. This logic might differ from logic set A, 

10 logic set B and the default logic set, and it may similarly take any of a variety of forms. 

The gateway 112 preferably also includes a record of which access point is serving each 

O client station. To accomplish this, when a client station gains admission to the access network 

JSJ via an access point, the access point may signal to the gateway 112. The gateway may then 

t record an indication that the client station is being served by that access point. 

-;J|5 Moving now to other entities on access network 102, the DHCP server function 116 is in 

place to assign temporary or permanent IP addresses to client stations 104, 106, through 

r*; communication with DHCP client applications running on the client stations. As such, the 

p DHCP server function 116 can take the form of a computer programmed with a DHCP server 
application. The DHCP server function 116 can be logically integrated within gateway 112, such 

1^0 as in the form of a DHCP server program executable by a gateway processor. 

Preferably, the DHCP server function 116 maintains a pool of IP addresses available for 
assignment to client stations operating in access network 102. The IP addresses may include 
addresses in each of the subnets, including addressed in the default subnet, addresses in subnet 
A, addresses in subnet B and addresses in subnet C. 

25 In the exemplary embodiment, when a subscriber first becomes associated with the 

access network, gateway 112 may cause the DHCP server 1 16 to assign to the client station an IP 
address in the default subnet. The gateway may then restrict communications with the client 
station as described above for instance. In turn, once the subscriber is authenticated by one of 
the service providers A, B or C, gateway 112 may cause the DHCP server 116 to assign to the 

30 client an IP address in the respective subnet. For instance, if a client is authenticated by service 
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provider A, gateway 112 may instruct DHCP server 116 to assign to the client an IP address in 
subnet A. 

The web server function 1 14, in turn, can take the form of a computer programmed with a 
web server application. As such, the computer may receive HTTP GET requests (requests for 
5 web pages (or "cards" for microbrowser use)) from browsers running on client stations 104, 106, 
and respond by sending web pages to the requesting browsers. 

In accordance with the exemplary embodiment, web server 114 may host an 
authentication-invite web page, which can be accessed by a browser on a client station for 
purposes of submitting an authentication request to a designated service provider. In order to 
10 force an authentication attempt when a subscriber first enters access network 102, gateway 112 
s _ s can be programmed to intercept HTTP GET requests destined for addresses outside network 102 

□ from any subscriber who has not yet been authenticated, and to redirect those requests to the 

i jj 

□ authentication-invite page on web server 114. Alternatively, a subscriber may voluntarily 
; f! browse to the authentication-invite page, in order to submit an authentication request. 

■B& The authentication-invite web page can be encoded with a form that a user can complete 

in order to submit an authentication request. As such, the web page can include a field (e.g., a 
Jr! drop down box) for a user to select a service provider from among those available (in the present 

□ example, service provider A, service provider B or service provider C). Further, the web page 
q can include fields for the user to input a name (e.g., a SIP address) and password and/or other 
|r io credentials. The web page can then include a "Submit" button, which, when selected by the user, 

invokes a program script to cause the authentication request to be sent to a specified address, 
preferably that of the authentication relay function 118. (Alternatively, the request could be sent 
to the web server, and the web server could programmatically forward it to the authentication 
relay function 1 18 if appropriate.) 

25 The authentication relay function 118 is, in turn, preferably also an application that runs 

on a computer or other entity. For instance, the authentication relay may be integrated with 
gateway 112, with web server 114, or with another entity. In accordance with the exemplary 
embodiment, the authentication relay mediates authentication requests submitted by subscribers 
on the access network. In particular, the authentication relay receives an authentication request 

30 from (or on behalf of) a given subscriber and forwards the authentication request (or generates 



13- 



MCDONNELL BOEHNEN 
HULBERT & BERGHOFF 
300 SOUTH WACKER DRIVE 
CHICAGO, ILLINOIS 60606 
TELEPHONE (312) 913-0001 



and sends a corresponding authentication request) to an authentication entity of a service 
provider designated in the authentication request. 

As such, the authentication relay might include or have access to a translation table that 
correlates service providers with network addresses of authentication entities arranged to 
5 perform authentication for those service providers. Each service provider might be designated 
by a respective service provider ID, and the translation table might indicate an IP address where 
the service provider's appointed authentication entity is located. For example, the translation 
table might correlate a service ID of service provider A with an IP address of an authentication 
entity in place to authenticate subscribers who are served by service provider A. As another 
10 example, the translation table might correlate a service ID of service provider B with an IP 
_ address of an authentication entity in place to authenticate subscribers who are served by service 
Q provider B. 

S The authentication relay 118 might receive authentication requests generated and sent 

;^ from the authentication-invite web page. Alternatively, the authentication relay function might 
:|5 receive authentication requests generated and sent in some other manner. For instance, a client 
; station such as station 104 might be programmed with logic to autonomously submit an 
^ authentication request upon admission to access network 102. Such a client station might be sold 
□ or otherwise issued by a specific service provider, such as service provider A, B or C. (For 
instance, the client station could be a mobile station issued by service provider A and might be 
m dual mode so that it can operate both via BTS 130 and via access network 102.) 

In the exemplary embodiment, the authentication request that the authentication relay 118 
receives will include in it a service ID or other indication of a designated service provider. 
Further, it will include in it subscriber authentication credentials, such as device ID or username 
and password for instance. 
25 In addition, the authentication request will preferably include an indication of which 

access point is currently serving the subscriber. The gateway 112 is well suited to insert this 
indication in the authentication request, since the authentication request preferably passes 
through the gateway 112 on its way to the authentication relay 118 and since the gateway 
preferably has a record of which access point is serving which subscriber. Alternatively, the 
30 access point may insert the indication. Still alternatively, the client station itself could insert the 
indication. Other examples are also possible. 
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In turn, the authentication request that the authentication relay 118 sends to the 
authentication entity of the designated service provider (possibly identical to the request that it 
receives) also preferably includes that information as well. 

The authentication relay 118 can send an authentication request to the authentication 
5 entity of the designated service provider in any manner, preferably according to an agreed 
protocol. The translation table maintained by the authentication relay 118 might indicate which 
protocol to use for communicating with each respective authentication entity. For instance, if the 
authentication entity is a RADIUS server, the authentication relay might send the authentication 
request according to the RADIUS protocol. Another exemplary protocol might be Diameter. 
10 As noted above, each service provider includes a respective service agent function 144, 

148, 150. In the exemplary embodiment, these service agents can be the authentication entities 
o of the respective service providers. To accomplish this, each service agent may include or have 
jSJ access to an authentication server, such as a RADIUS or AAA server. Each service agent may 
"f then be programmed or otherwise arranged to receive authentication requests, to determine 
i: fj5 whether and to what extent subscribers are allowed to access services (i.e. to authorize 

subscribers), and to provide authentication responses. 
H The authentication relay 118 preferably communicates with the authentication entity on a 

p given service provider network via a secure tunnel. In the arrangement shown in Figure 3, for 
;i? instance, the tunnel to each service agent passes through IP network 120, a respective firewall, 
m and the respective service provider network. Alternatively, the tunnel could be a direct 
connection such as a Tl line through suitable gateways and/or switches. The level of security (if 
any) is a matter of choice. 

In the exemplary embodiment, the service agent of a given service provider authenticates 
a subscriber by reference to a data store. For instance, as noted above, service agent 144 may 
25 have access to data store 146, service agent 148 may have access to data store 152, and service 
agent 150 may have access to data store 154. Alternatively, multiple service providers may 
employ or refer to a common service agent and/or a common data store (e.g., a meta-directory). 

In the exemplary embodiment, the data store of each service provider may take the form 
of a flat file or a more complex database (e.g., an Oracle database) and preferably includes data 
30 to facilitate authenticating subscribers. Further, the data store might also include data to 
facilitate authorizing and billing subscribers and to facilitate other value-added services, such as 
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services keyed to the locations in access network 102 where subscribers are operating. As such, 
the arrangement of each data store could take various forms and may vary from service provider 
to service provider. By way of example, a data store might include (i) authentication records 
160, (ii) user/terminal/service records 162, (iii) accounting records 164, and (iv) location records 
5 166. 

The authentication records 160 preferably include information that will allow the service 
provider to authenticate subscribers who are seeking to operate on access network 102 (or, for 
that matter, on any other access network). As such, the authentication records 160 preferably 
include authentication information for at least those subscribes who have subscribed to service of 
10 the service provider. But the authentication records may also include authentication information 
for other subscribers, such as subscribers of another service provider. In this regard, for instance, 
p service providers might enter into agreements according to which one service provider provides 
jrf services for subscribers of another service provider. 

<g The particular form of the authentication records may vary from case to case. As an 

jjs example, each record might be keyed to a subscriber ID and might indicate an associated 
password for the subscriber. Upon receipt of an authentication request that indicates a subscriber 
{<* ID and password, the service agent may refer to the data store and determine whether the 
q password matches that associated with the subscriber ID. As another example, if the subscriber 
* ID is a station ID for instance, each record may merely indicate a station ID (without a 
m password). Upon receipt of an authentication request that indicates the station ID, the service 
agent may then refer to the data store to determine whether the device ID is listed. 

The user/terminal/service records 162 preferably define service-qualifications on a per- 
subscriber (e.g., per-user and/or per-station/terminal) basis. For instance, the records might 
specify for each of the service provider's subscribers what types of services each subscriber is 
25 authorized to access, and/or an extent (e.g., duration, quality, etc.) to which the subscriber can 
access particular services. These authorizations may be keyed to service levels paid for by the 
subscribers. For instance, one subscriber might pay more to have access to more or better 
services than another subscriber. Further, the user/terminal/service records may correlate users 
with terminals, such as by indicating which client station a particular user is currently using. 
30 As an example, the user/terminal/service records might include for each subscriber an 

indication of whether the subscriber is entitled to engage in certain types of communications over 
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IP network 102. For instance, a subscriber profile record might indicate whether a subscriber is 
allowed to engage in HTTP communications, FTP communications and/or SIP communications. 
Further, a user/terminal/service records might indicate a level of bandwidth that should be 
allocated to the subscriber for particular types of communications over the IP network 102, or 
5 over the access network 102. 

And as another example, the user/terminal/service records might indicate that a 
subscriber is allowed to engage in only a predefined quantity of communication. For instance, 
the user/terminal/service records might indicate that a subscriber is allowed to send only a 
designated number of bits, bytes or packets of data, or only a designated number of SIP INVITE 
10 (session initiation) requests. Other examples are also possible. 

The accounting records 164, in turn, may define billing records for individual subscribers 
p or groups of subscribers. For instance, once a service provider has authenticated a subscriber 
g operating in access network 102, the service provider may establish a billing record that can be 
=| used to bill the subscriber for the service. Further, in the event the service provider carries or 
:j|5 conducts particular communications for the subscriber during the subscriber's operation in the 

access network, the service provider may establish or modify billing records accordingly. 
|^ The location records 146 preferably establish where particular subscribers are located. 

P For instance, once a service provider authenticates a subscriber operating in a particular access 
network or portion thereof, the service provider may store in the location records 146 an 
m indication that the subscriber is operating at that location. As indicated above, the authentication 
request received by the service provider may indicate the access point currently serving the 
subscriber. Therefore, the service provider may store an indication of that access point as the 
location where the subscriber is operating. 

In the exemplary embodiment, the service provider may then later use that location 
25 indication to facilitate providing a service to the subscriber in the access network. For instance, 
the service provider may later transmit to the subscriber an advertisement for a store or other 
business establishment in or near which the subscriber is located (e.g., a store by which the 
access point currently serving the subscriber is located), as determined by a translation table that 
correlates access-network locations (e.g., access point identifiers) with business establishments. 
30 The service provider may then charge the store for this advertising service. As another example, 
the service provider can make the location information available to another party, to allow the 
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other party to provide location-based services for the subscriber. Other examples are possible as 
well 

In the exemplary embodiment, when the service of a service provider receives an 
authentication request, the service agent will seek to authenticate the subscriber by reference to 
5 the authentication records 160. Further, the service agent may seek to authorize the subscriber 
by reference to the user/terminal/service records 162. In addition, the service agent may record 
billing information in the accounting records 164. And the service agent may record in location 
records 166 an indication of where the subscriber is located. 

The service agent will then generate an authentication response, which it will send back 
10 down to the authentication relay 1 18 or to another designated entity (e.g., directly to the gateway 
1 12.) The authentication response will preferably indicate whether or not the service provider 
2 has authenticated the subscriber (e.g., as a Boolean indication), and may provide service 

"a 

; qualification information indicating types and extents of services to which the subscriber is 
= entitled. 

fl 5 The authentication relay 118, in turn, will be programmed or otherwise arranged to 

receive the authentication response and to forward the response (or a derivative of the response) 
Mj to an enforcement point in the access network 102. In the exemplary embodiment, the 
iff enforcement point is preferably gateway 1 12. 

|2j Thus, the gateway will receive a message indicating whether or not the subscriber has 

m been authenticated by the designated service provider, preferably together with an indication of 
the service provider. For instance, if service provider A has authenticated client station 104, the 
message may identify the subscriber (e.g., by subscriber ID), identify service provider A (e.g., by 
service provider ID) and indicate successful authentication. Further, the message may provide 
the gateway with service qualifications for the subscriber, possibly conveyed in a markup 

25 language such as Diameter (e.g., BANDWIDTENx bps, FTP=false, SHMrue, etc.) Another 
suitable protocol for communicating the authentication response is the recently established 
802. lx protocol (which incorporates EAP (extensible authentication protocol)). 

According to the exemplary embodiment, assuming successful authentication of a 
subscriber by a designated service provider, the gateway 112 may be programmed to assign the 

30 subscriber to the logical network layer associated with the designated service provider (or to 
cause the subscriber to be assigned to that layer). For instance, if service provider A 
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authenticates the subscriber, the gateway may assign the subscriber to subnet A. If service 
provider B authenticates the subscriber, the gateway may assign the subscriber to subnet B. And 
if service provider C authenticates the subscriber, the gateway may assign the subscriber to 
subnet C. 

5 Assuming that the subscriber has already been assigned to the default subnet (or other 

default layer of the access network 102), the gateway could cause the subscriber to be assigned 
to the subnet of the authenticating service provider by directing the subscriber to release its 
current IP address and to request a new IP address. And the DHCP server 1 16 would then assign 
to the subscriber an EP address in the subnet of the service provider. (In an exemplary 
10 embodiment, the DHCP server could assign each IP address with a short lease, so that the 
subscriber periodically requests a new address; upon expiration of the lease on the default IP 
□ subnet address, the DHCP server 116 can then assign an IP address in the service provider 
;S( subnet.) 

*h As noted above, the gateway is then preferably arranged to provide distinct levels and 

; : j5 types of service on each segregated layer. Thus, if a subscriber has been authenticated by service 

provider A and the subscriber has therefore been assigned to subnet A, the gateway might apply 
H; its logic set A for the subscriber. And if a subscriber has been authenticated by service provider 
p B and the subscriber has therefore been assigned to subnet B, the gateway might apply its logic 
ji: set B for the subscriber. Or if the subscriber has not been authenticated, so the subscriber 
m remains on the default subnet, the gateway might apply its default logic for the subscriber. 

In addition, if the authentication response carries service qualification information for the 

subscriber, the gateway might record that service qualification information for use with respect 

to communications by the subscriber. Effectively, the gateway can maintain a local profile for 

the subscriber. Logic in a subscriber's local profile could take precedence over logic defined for 
25 the subnet on which the subscriber is operating. Or the subnet logic could take precedence over 

the local profile logic. This is a matter of choice. 

3, Exemplary Operation 

As an example of operation, assume that a user has an 802.1 lb-capable client station 104. 

The user brings the client station into an department store. Assume that the department store is 
30 equipped with an 802.11b WLAN, including APs. Assume further that the APs of the WLAN 

provide for open association. I.e., the APs allow any 802. lib-compliant client station to gain 
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radio-link access to the AP and perhaps then via the WLAN to a set of default WLAN resources. 
(In an alternative arrangement, the APs could require a client station to send a particular service 
set ID (SSID) of the WLAN in order to gain access to the WLAN). 

When the user turns on the client station in the airport terminal, the client station may 
5 thus establish an association with a nearby AP, through normal procedures. (E.g., either the 
client station or the AP could emit a beacon that the other would detect, thereby causing the other 
to send out an access request.) For instance, the client station 104 might gain association with 
AP 108. 

In turn, the a DHCP client application running on the client station would send a DHCP 
10 request via the MAC layer (radio-link layer) and the access network to the gateway, and the 
gateway would consult the DHCP server to get an IP address for the client station. In particular, 
P the DHCP server would assign an IP address in the default subnet, so that the client station will 
y be able to access only default access network resources. 

:.p The gateway would then provide a DHCP response to the client station, assigning the 

> Js designated IP address to the client station. Given the designated IP address, the client station has 
thus gained access to resources of the access network, so as to be able to send and receive IP 
U communications within the access network. 

g Once the client station has thus gained access to the WLAN and has the ability to send 

and receive IP communications within the access network, the client station will preferably 

{20 generate and send an authentication request, which would go to the authentication relay. For 
instance, the user may browse to the authentication-invite web page and may select service 
provider A and provide authentication credentials. A script underlying the web page may then 
generate and send the authentication request to the authentication relay. 

As described above, the authentication request will preferably indicate (i) the designated 

25 service provider, (ii) the subscriber's authentication credentials, and (iii) an indication of the 
access point serving the subscriber. 

Upon receipt of the authentication request, the authentication relay would then read the 
authentication request to determine which service provider is designated and would determine 
the network address of the service agent of that service provider. In this example, the 

30 authentication relay would determine that service provider A is designated, so the authentication 
relay would programmatically conclude that the authentication request should be sent to service 
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agent 144. The authentication relay would then send the authentication request to that service 
agent. 

Service agent 144 of service provider A will then receive the authentication request and, 
based on the credentials in the request, query data store 146 in an effort to determine whether and 
5 to what extent the client station should be authenticated. Based on the results of this query, the 
service agent may then generate an authentication response message and send the authentication 
response message back to the authentication relay. Further, the service agent may record in the 
data store an indication of where the client station is currently located. 

Once the authentication relay receives the authentication response from the designated 
10 service provider, the authentication relay will then forward the response back to the gateway. 
Assuming successful authentication, the gateway will then assign the client station to a subnet 
q associated with the authenticating service provider. And the client station may then operate on 
J2; that subnet. Further, if the authentication response or other such message provides the gateway 
=g with service qualifications indicated by service provider A, the gateway may record and enforce 
J5 those service qualifications. 

For example, the authentication response provided by service agent 144 might indicate 
i=* that the client station is authenticated and that the client station is entitled to initiate at most three 
q sessions through use of SIP . Thus, the gateway might record that restriction. As the client 
JJj station sends SIP INVITE requests, the gateway might decrement a counter for the client station. 
m And, after the client station has sent three SIP INVITE requests, the gateway may then bar any 
subsequent SIP INVITE requests from the client station. As another example, the gateway might 
insert into HTTP communications to the client station a banner ad for service provider A or other 
information specific to service provider A. 

According to another aspect of the exemplary embodiment, the service provider itself can 
25 customize services provided to the subscriber in the access network. For instance, while the 
client station is operating on access network, the service agent (or other entity) might determine, 
from location records 166 in data store 146, that the client station is located near AP 108. The 
service agent or other entity might then send to the client station a message (e.g., e-mail, SMS, 
HTTP PUSH or other type of message) providing information about a special deal being offered 
30 in a nearby department in the department store. Service provider A may then charge the 
department store for the service of sending that message to the client station. 
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As another example, the service agent could send a broadcast or multicast message (e.g., 
a service provider advertisement) out to all of the client stations in the access network who are 
operating on the service provider's segregated layer of the access network. Preferably and 
beneficially, such as message would not reach client stations that have been authenticated by 
5 other service providers or who have not yet been authenticated by a service provider, since those 
client stations are operating on another segregated layer. 

According to yet another aspect of the exemplary embodiment, gateway 112 may be 
programmed to function as a mobile IP foreign agent. In turn, the service agent of the service 
provider that authenticates the subscriber may be programmed to function as a mobile IP home 
10 agent. For instance, service agent 144 in network A might be the home agent for subscribers of 
service provider A. When one such subscriber registers in access network 102, gateway 112, as 

□ foreign agent, may register with the subscriber's home agent, service agent 144. 

g As a result, communications to or from the subscriber might be made to pass through the 

*f service agent. The service agent may then act upon the communications. For example, the 
■M service agent itself might modify or communications based on various factors. As another 
example, the service agent can provide statefiil services for the subscriber, such as prepaid data 
I* communications for instance. Other examples are also possible. 

ill 

□ ^ exemplary embodiment of the present invention has been described above. Those 
g skilled in the art will understand, however, that changes and modifications may be made to this 
120 embodiment without departing from the true scope and spirit of the present invention, which is 

defined by the claims. 
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